January 16, 2012, 9:06 PM — RSA Security Chairman Art Coviello says customers still want to hear details about how the company so quickly detected the data breach that last year compromised its SecurID tokens.
He also says businesses have been slow to pick up on new security models, many touted by RSA, that would help reduce the impact of successful breaches.
Here is a partial transcript of a recent conversation Coviello had with Network World Senior Editor Tim Greene on those topics as well as cloud security, managing risk and the limitations of the press.
BREACH PROTECTION: Cyber insurance offers IT peace of mind -- or maybe not
What's the fallout been from the data breach?
If there's a silver lining to the cloud that was over us from April through over the summer it is the fact that we've been engaged with customers at a strategic level as never before, and they want to know in detail what happened to us, how we responded, what tools we used, what was effective and what was not.
What are those conversations like?
Again, a silver lining to us being attacked, I've heard it time and time again, "If it can happen to you then I guess it can happen to anybody," or, "My CIO said, 'Oh my god if it happened to them let's redouble our efforts, let's review everything we're doing.'" It's kind of gotten to even a CEO level. I was actually brought into a major money center bank in Europe at the CIO's request to talk to the CEO of the bank and his whole management team about the threats and vulnerabilities that exist today. The reason he brought me in was they were doing an overhaul of their IT infrastructure which included the development of a private cloud. Even though it's an internally controlled cloud he wanted the management group to understand the security ramifications of the infrastructure change that the bank was about to go through. I'm at a [similar] level with Fortune 10 oil and gas, manufacturing, pharmaceuticals. I've always had pretty good entree into financial services as that example illustrates, but I'm getting in at levels that are unprecedented in terms of the contacts and the people I'm talking to. It's so ironic. I've never been in more demand as a speaker or in front of internal audiences. I would usually be at a chief security officer level but not a CIO level or even higher. I think we are turning from awareness of the problem to action. I'm just sad that we didn't do it two or three years ago before a lot of these celebrated breaches took place.
TEST YOUR RECALL: The data breach quiz